Driftcha

Open-source CAPTCHA experiment

Every frame is static.
The digits only exist in motion.

Driftcha hides a four-digit code in a field of flickering dots. Freeze any single frame and you get uniform noise. Let it play, and your visual system pulls the digits right out of it.

  • Two rounds: black-and-white, then full color
  • Server mode: frames are streamed, the answer never reaches the page
  • Proof-of-work on every button press
  • Zero runtime dependencies, MIT licensed

Callback events

  1. Pass or miss a round to see the widget's callbacks here.

How it works

Every pixel is a dot that lives for a fraction of a second. The background is cut into patches that drift in random directions; inside each digit the dots drift the same speed, another way.

Fig. 1 One frame. Freeze it and there is nothing to find. No pixel, region or color differs from the rest.
Fig. 2 In motion. The same dots, playing. Four digits surface the moment they move.
Fig. 3 Tinted by direction. What your eyes work out on their own: the digits drift against the patches around them. Background muted for clarity.
Rendered live in your browser by the same engine. Fig. 3 uses the engine's ground truth.

Defenses

Uniform frames
Digits and background share dot speed, lifetime, color and direction statistics, so no per-pixel measurement points at the code.
engine
Readable shapes
Digits stay upright and unwarped. Bending them only trips weak OCR, while people squint. A 1 is always a single bar, so it never reads as a 7.
engine
Proof of work
Each press of Verify or New code first solves four SHA-256 puzzles in a Web Worker. Every miss in the last minute doubles the work.
client + server
Typed, not pasted
Only trusted keystrokes count, one digit each. Paste, drop, autocorrect and scripted input are rejected, and the typing rhythm gets a sanity check.
client
Answer stays home
In mock-server mode the code, the rendering and the checks never leave the server. A solved session earns a signed, single-use pass token.
server

Two modes

Browser only Mock server
Code lives in page memory server memory
Frames rendered by the browser the server, streamed at 30 fps
Answers and proofs checked by the browser the server
Pass token for your backend none HMAC-signed, single use
Works on static hosting yes no, needs Node.js

Browser-only mode suits demos and static sites; any script on the page can read its answer. The mock server has the right shape for production but keeps state in memory with simple limits. Either way, treat Driftcha as a speed bump: in our tests a short motion-analysis script cut the digits out of the stream in seconds, and settings that stopped it also stopped people. Read the security model in the README before relying on it.